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Summary 

The evolution of commercial transport flight deck 
configurations over the past 20-30 years and expected 
future developments are described. 

Key factors in the aviation environment are identified that 
the authors expect will significantly affect flight deck 
designers. One of these is the requirement for commercial 
aviation accident rate reduction, which is probably required 
if global commercial aviation is to grow as projected. 
Other factors include the growing incrementalism in flight 
deck implementation, definition of future airspace 
operations, and expectations of a future pilot corps that 
will have grown up with computers. 

Future flight deck developments are extrapolated from 
observable factors in the aviation environment, recent 
research results in the area of pilot-centered flight deck 
systems, and by considering expected advances in 
technology that are being driven by other than aviation 
requirements. The authors hypothesize that revolutionary 
flight deck configuration changes will be possible with 
development of human-centered flight deck design 
methodologies that take full advantage of commercial 
and/or entertainment-driven technologies. 

Background and Assumptions 

To provide a basis for discussions of future flight decks, it 
is important to understand why we need human operators 
in the commercial aviation system, how aviation safety is 
currently measured, the nature of aviation accidents, the 
evolution of commercial jet transport flight decks, and the 
factors involved in changing flight deck designs. 

The Requirement for Human Operators 

The airspace system is defined as the aircraft that are 
operating on the airport surface as well as in the air, the 
ground-based systems that provide supporting 
infrastructure, the human operators in both the aircraft and 
on the ground, and the procedures and rules for the human 
operators in the system. The airspace system has dynamic 
elements that are both continuous (aircraft flying) and 
discrete events (takeoff clearance). These continuous and 
discrete elements are numerous and interactive. A complete 
and accurate model of the entire airspace system has not 
yet been created and is not likely to be developed and 
validated for many years to come, if ever. Further 
complicating this situation is the fact that certain airspace 


system variables, such as the weather, are beyond our 
ability to accurately predict. 

For the above reasons, our current airspace system relies 
almost exclusively on humans as control elements. The 
control architecture of the airspace system is such that 
ground-based personnel are mostly located in the system 
outer loops and pilots are mostly located in the system 
inner loops. From the perspective of a control designer, 
the inability to model the airspace system with any 
reasonable degree of fidelity leads to the conclusion that an 
automatic control structure cannot be practically designed 
for the airspace system, given the desired levels of risk and 
cost. Given that full automation is not possible, a system 
containing both machine and human control elements will 
be required. It seems clear that it will be quite some time 
before fully automated aircraft are flying in commercial 
passenger service. 

There is another reason that fully automated aircraft are not 
likely to provide commercial passenger service in 
foreseeable future. A fully automated aircraft would be 
designed and manufactured by humans. Since any aircraft is 
subject to human error right off the production line, the 
degree of automation is merely a choice among which 
humans can introduce error, not whether error occurs. At 
some level, a system is sufficiently complex that no 
single human can understand the entire design. This 
requires multiple humans to become involved in the 
design, with imperfect communication between humans 
becoming a major opportunity for error creation and 
propagation. Removing the human operator just puts the 
full burden of error on the designer and manufacturer. Even 
if the design and manufacturing were perfect, there is 
always the possibility that “the critical part” may not be 
installed or may be installed incorrectly during routine 
maintenance. The history of aviation is replete with 
examples of aircraft suffering failures that were never 
anticipated by the designers, but which became survivable 
due to human operator ingenuity. Although the aviation 
community has long believed that the humans in the 
aviation system prevented far more accidents than they 
caused, only recently have incident collection and analysis 
efforts begun to provide initial data that appear to validate 
this belief. (1) 

Aviation Safety — the Accident Rate Plateau 

Although technically we do not know how to measure 
safety with a single parameter, in discussions with the 
general public, the aviation industry generally uses “hull 
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loss” or “fatal” accident statistics for commercial jet 
transport aircraft. “Hull loss” is used by the industry to 
describe an accident where the aircraft is damaged beyond 
economical repair. Figure 1 shows the historic trends and 
probable trends in commercial aviation accidents. Hull loss 
accidents often result in fatalities and are almost always 
treated to extensive coverage in the local, if not worldwide, 
press. As can be seen from the figure, the accident rate has 
been essentially constant for at least 20 years. To the 
authors’ knowledge, the Boeing Company first drew public 
attention to the fact that if the accident rate remained 
constant, and airline traffic grew as they projected, then the 
number of hull loss accidents worldwide would reach 
almost one per week in the year 2015. This is now viewed 
by the aviation community as something that the public 
will not accept, implying a limited growth scenario for 
airline traffic unless something is done to reduce the hull 
loss or fatal accident rate. (2) 
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Figure 1 — Global Commercial Airline Transport Safety Trends 
(data from Boeing) 

The readily available statistics on hull loss or fatal 
accidents for large jet transports, general aviation and 
rotorcraft are reported by various sources. (3,4) These sources 
gather information that varies according to factors such as 
the country in which the fatal accident occurred, the type of 
vehicle involved (large jet transport, general aviation, etc.), 
and the manufacturer of the aircraft (most commercial 
airline transport manufacturers have additional data on a 
fatal accident involving one of “their” aircraft). These 
statistics tend to be categorized according to “what 
happened” instead of “why it happened.” 

Figure 2 shows a summary of primary cause factors for 
commercial airline transport hull loss accidents during the 
period 1987-1996. The percentages shown are based on the 
71% of accidents during this period for which a “known 
cause” has been established and documented by the 
cognizant accident investigation authority. The primary 
cause factor distribution is essentially similar to that 
during the period 1959-1995. As has been the case during 
almost the last 40 years, the “flight crew” is listed as the 
prevalent primary cause factor in the commercial airline jet 
fleet. This is usually referred to as “pilot error.” A British 
study of accidents during 1980-1996 included turboprops 
and business jets, as well as accidents involving “Eastern- 


built” aircraft during the period 1990-1996, and reached 
similar conclusions. (5) 
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Figure 2 — Primary Cause Factors for Global Commercial Jet 
Fleet Hull Loss Accidents, 1987-1996 (data from Boeing) 


Most accident investigations that identify “pilot error” as a 
primary or major causal factor typically do not analyze 
why this error (or errors) occurred. This has happened in 
part because a conclusive analysis has often not been 
possible given the available data. Another factor is that the 
accident investigation authorities have historically been 
focused on identifying the specific sequence of events that 
resulted in the accident, with less attention on determining 
why each event occurred. Until very recently, “pilot error” 
was viewed as something that happened to the unlucky or 
incompetent, and most accident investigation authorities 
have not performed analyses of why “pilot error” occurs. 

Unfortunately, the preponderant tendency for an accident 
investigation report to conclude by attributing the primary 
cause to “pilot error” has clouded the fact that there are 
almost always contributing causes from design, training, 
operations, maintenance, personal, and other factors. 

There is also a tendency in many parts of the aviation 
industry to think that accident rate reductions can be 
obtained by changing training and procedures alone. This 
view does not appear to be supported by the evidence, 
since the global fatal accident rate is essentially unchanged 
for the last twenty years. If different training and 
procedures were the only answer, the authors believe the 
results would be more apparent in recent accident rate 
statistics than is the case. 

Another argument that is often made for focusing on 
training and procedures versus design is the reality that 
changes in design will take longer to implement, and 
therefore, it will take longer to realize the benefits of new 
designs. The authors agree that any design changes, 
whether implemented in new aircraft or retrofitted, will 
take time to implement. However, if the desired 
improvements in aviation safety require design changes, 
then such changes must be pursued. This will be discussed 
again later in this paper. 
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A Model for Aviation Accidents 

The FAA has presented a conceptual model for aviation 
accidents - a beam of light trying to pass through a box 
containing multiple rotating disks, where each disk 
contains a set of holes. (6) As shown in Figure 3, when the 
holes on all of the disks are in alignment, the light beam 
passes through the box and comes out the other side, 
meaning an accident has occurred. This model captures the 
fact that in almost every accident, multiple events must 
occur in a certain combination to trigger the accident. This 
model also supports by implication the earlier assertion 
that the aviation system is non-deterministic and currently 
impossible to model in its totality. 





Figure 3 — An Accident : The Holes in the Wheels Line Up 

Given this model, there are three possible strategies for 
preventing a fatal accident. Figure 4 represents the first of 
these strategies - create a system, technology, or procedure 
to prevent an error/failure or series of errors/failures from 
resulting in an accident (“plug” holes in the last rotating 
disk). The second strategy is shown in Figure 5 - in this 
strategy, an overall system or set of procedures is designed 
to prevent a small error/failure from causing more serious 
problems (fill some holes in each of several rotating 
disks). This is also sometimes referred to as “catching the 
problem early” or “trapping errors.” Figure 6 portrays the 
third strategy, which involves implementing some new 
capability that prevents or significantly reduces the 
probability of a whole class of accidents (plug holes in the 
first rotating disk). 



Figure 4 — Prevention Strategy A: Mitigate Failure Effects 



Figure 5 — Prevention Strategy B: System Design to Minimize 
Failure Impacts or Propagation 



Figure 6 — Prevention Strategy C: New Capability or 
Information to Eliminate Whole Categories of Accidents 


Historically, the most prevalent strategy employed has 
been Prevention Strategy A. Prevention Strategy B is 
employed less often, and Prevention Strategy C is only 
rarely employed. It is a thesis of the authors that the 
industry has achieved much of the accident rate reduction 
that is possible from using Prevention Strategy A. 
Therefore, a more systems-oriented approach that includes 
Prevention Strategies B and C should be emphasized in the 
future if additional accident rate reduction is to be realized. 

Commercial Transport Flight Deck Evolution 

The commercial transport flight deck has evolved 
considerably since the first days of the Boeing B-707 and 
Douglas DC- 8. In this discussion, flight decks are 
discussed as designed, even though the authors realize that 
many are operating today in modified form, having been 
retrofitted with various systems (GPWS, TCAS, etc.) that 
vary across the world. Retrofits are discussed later in the 
paper. Also in this discussion, the word “generation” is 
used to refer to a level of capability, not the point in time 
when the design was created. Finally, this section is 
written primarily from the flight crew’s perspective, not 
the design engineer’s perspective. 

Even though it is not discussed, the flight deck evolution 
of business/regional jets and turboprops has generally 
followed the evolutionary path described below for large 
commercial transport aircraft flight decks. 

The “classic” flight deck, which includes the above aircraft 
plus the B-727, the DC-10, and early series B-747, is 
relatively lacking in automation. A representative “classic” 
flight deck is shown in figure 7. All of these aircraft are 
characterized by the relative simplicity of their autopilot, 
which offers one or a few simple modes in each axis. In 
general, a single instrument indicates the parameter of a 
single sensor. In a few cases, such as the Horizontal 
Situation Indicator, a single instrument indicates the “raw” 
output of multiple sensors. Regardless, the crew is 
generally responsible for monitoring the various 
instruments and realizing when a parameter is out of range. 
A simple caution and warning system exists, but it covers 
only the most critical system failures. 



Figure 7 — Representative “Classic” Flight Deck (DC- 10) 


3 



The first generation of “glass cockpit” flight decks, which 
include the B-757/767, A-310, and MD-88, receive their 
nickname due to their use of Cathode Ray Tubes (CRTs). 
A representative first generation “glass cockpit” flight deck 
is shown in figure 8. A mix of CRTs and instruments was 
used in this generation of flight deck, with instruments 
used for primary flight information such as airspeed and 
altitude. A key innovation in this flight deck was the “map 
display” and its coupling to the Flight Management 
System (FMS). This enabled the crew to program their 
flight plan into a computer and see their planned track 
along the ground, with associated waypoints, on the map 
display. Accompanying the introduction of the map 
display and FMS were more complex autopilots (added 
modes from the FMS and other requirements). This 
generation of aircraft also featured the introduction of an 
integrated Caution and Warning System, usually displayed 
in a center CRT with engine information. A major feature 
of this Caution and Warning System was that it prioritized 
alerts according a strict hierarchy of “warnings” (immediate 
crew action required), “cautions” (immediate crew 
awareness and future action required), and “advisories” 

(crew awareness and possible action required). (7) 



Figure 8 — Representative First Generation “Glass Cockpit” 
(B-757) Flight Deck 

The second generation of “glass cockpit” flight decks, 
which include the B-747-400, A-320/330/340, F-70/100, 
MD-1 1, and B -777, are characterized by the prevalence of 
CRTs (or LCD’s in the case of the B-777) on the primary 
instrument panel. A representative second generation 
“glass cockpit” flight deck is shown in figure 9. 
CRT/LCD’s are used for all primary flight information, 
which is integrated on a few displays. In this generation of 
flight deck, there is some integration of the FMS and 
autopilot - certain pilot commands can be input into either 
the FMS or autopilot and automatically routed to the 
other. 

There are varying levels of aircraft systems automation in 
this generation of flight deck. For example, the MD-1 1 
fuel system can suffer certain failures and take corrective 
action - the crew is only notified if they must take some 


action or if the failure affects aircraft performance. The 
caution and warning systems in this generation of flight 
decks are sometimes accompanied by synoptic displays 
that graphically indicate problems. Some of these flight 
decks feature fly-by- wire control systems - in the case of 
the A-320/330/340, this capability has allowed the 
manufacturer to tailor the control laws such that the flying 
qualities of these various size aircraft appear similar to 
pilots. The latest addition to this generation of flight deck, 
the B-777, has incorporated “cursor control” for certain 
displays, allowing the flight crew to use a touchpad to 
interact with “soft buttons” programmed on these displays. 
Another feature of the B-777 flight deck is a “closed-loop 
electronic check list” - this system senses control switch 
positions on the flight deck and automatically checks off 
the appropriate item on the checklist. This is in contrast to 
other available “open-loop electronic checklists” which 
require the flight crew to manually check off each item, 
even if they have already set the required control switch. 



Figure 9 — Representative Second Generation “Glass Cockpit” 
(A-320) Flight Deck 

It is not clear when the next generation of large 
commercial transport flight decks will appear. Given the 
rate at which “new” large commercial transport aircraft are 
created, it could easily be a decade from now. However, it 
will occur, and there are a variety of possible forces and/or 
events that could precipitate the advance to the next 
generation. These will be discussed later in the paper. 

Factors Influencing Flight Deck Design Changes 

Flight deck changes in large commercial transports can be 
associated with new or derivative airplane programs, or can 
be introduced into existing aircraft in the form of retrofits. 
Typically, no change in a flight deck will be made unless 
there are new requirements or new objectives. The 
difference between requirements and objectives is subtle, 
nonetheless, it plays an important role in determining how 
flight decks are modified. Requirements must be met by 
new designs, objectives should be met if practical. (8) 
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The most significant changes in flight deck design are 
usually associated with a new airplane program or a 
derivative airplane program with significant operational or 
functional requirement changes, such as with the B-747- 
400 (the major requirement change being for operation by 
a two-person crew instead of the three-person crew of 
previous B-747’s). However, new or derivative airplane 
programs do not always require significant flight deck 
changes. 

Marketing requirements may have significant impact on 
flight deck changes: A derivative aircraft may not be 
marketable unless it has a common type rating with an 
earlier version, resulting in a requirement for the flight 
deck to be as similar to the previous flight deck as 
possible; conversely, a new aircraft may be more 
marketable if its flight deck is a basis for customers to 
choose the product. 

Airlines can also require some update to the existing fleet, 
such as addition of a head-up display to obtain some 
operational advantage or improvement. Changes can also 
be mandated by regulation, such as the mandate for ground 
proximity warning systems (GPWS) or traffic alert and 
collision avoidance systems (TCAS). 

“Certification risk” is lower if a new flight deck is similar 
to a previous one. (8) “Precedence” is used as a basis for 
certifying many of the human factors aspects of flight 
decks. (9) If the flight deck features are the same as or 
similar to a previous aircraft, or if the flight deck design 
results in equal or lower workload than a previously 
certified aircraft, then it is judged acceptable. A design that 
cannot be certified is a financial disaster for a commercial 
transport manufacturer. Uncertificable designs may be 
modified until they are acceptable to the certification 
authority, but this can be costly. The financial stakes 
associated with certification risk translate into the logical 
reality that such risks are not taken without substantive 
cause. 

There is no incentive for manufacturers to change flight 
deck designs unless there are explicit requirements or 
benefits driving flight deck changes. Although 
requirements may imply fixed and uncompromised 
necessities, this is not always the case. For example, it is 
hard to imagine “aesthetically pleasing” as a requirement 
for flight deck design, but if customers indicate that this 
will be a factor in ordering aircraft, it may well become a 
requirement. 

Design objectives may encompass many areas, including 
most of the advances in human factors, human-centered 
design, cognitive psychology, and cognitive engineering 
that have implications for flight deck design and flight 
crew performance and, by logical extension, aircraft safety. 
It is recognized that there may be changes to the design of 
flight decks that will increase automation usability, 
enhance flight crew situation awareness, and reduce pilot 


errors, but they often are considered objectives. Further, 
some of these objectives suggest significant changes in 
flight deck designs, which, by default, conflict with 
requirements to keep future designs as similar to previous 
designs as possible. If an objective conflicts with a 
requirement, there is little doubt which will prevail. 

Trends in the Aviation Environment 

There are several trends that can be observed in aviation 
which will influence future flight deck designs. These 
include both flight deck trends and airspace system trends. 

FAA Study on Flight Deck Issues 

On April 26, 1994, an Airbus A300-600 operated by 
China Airlines crashed at Nagoya, Japan, killing 264 
passengers and flight crew members. Contributing to the 
accident were conflicting actions taken by the flight crew 
and the airplane’s autopilot. The crash provided a stark 
example of how a breakdown in the flight crew/automation 
interface can affect flight safety. Although this particular 
accident involved an A-300-600, other accidents, incidents, 
and safety indicators demonstrate that this problem is not 
confined to any one airplane type, airplane manufacturer, 
operator, or geographical region. This point was tragically 
demonstrated by the crash of a B-757 operated by American 
Airlines near Cali, Columbia on December 20, 1995, and 
a November 12, 1995 incident (very nearly a fatal accident) 
in which an American Airlines MD-80 descended below 
the minimum descent altitude on approach to Bradley 
International Airport, Connecticut, clipped the tops of 
trees, and landed short of the runway. 

As a result of the Nagoya accident, as well as other 
incidents and accidents that appear to highlight difficulties 
in flight crews interacting with flight deck automation, 1 (10) 
the Transport Airplane Directorate of the FAA’s Aircraft 
Certification Service launched a study in early 1995 to 
evaluate the flight crew/flight deck automation interfaces 
of current generation transport category airplanes. The 
study team included participants from the FAA, JAA 
(Joint Aviation Authorities), NASA, and a technical 
advisor from each of three universities in the United 
States. 

The study team’s report identified issues that show 
vulnerabilities in flight crew management of automation 
and situation awareness. (9) Issues associated with flight 
crew management of automation included concerns about: 

• Pilot understanding of the automation’s 
capabilities, limitations, modes, and operating 
principles and techniques. 

• Differing pilot decisions about the appropriate 
automation level to use or whether to turn the 
automation on/off when in unusual or non-normal 
situations. This may lead to potential mismatches 


5 



with the manufacturers’ assumptions about how 
the flight crew will use the automation. 

Flight crew situation awareness issues included 
vulnerabilities in, for example: 

• Automation/mode awareness. 

• Flight path awareness, including insufficient terrain 
awareness (sometimes involving loss of control or 
controlled flight into terrain) and energy awareness 
(especially low energy state). 

The study team’s report concluded that these vulnerabilities 
exist to varying degrees across the current fleet of transport 
category airplanes in the study, regardless of the 
manufacturer, the operator, or whether accidents have 
occurred in a particular airplane type. The team’s report 
described a number of recommendations to address the 
vulnerabilities through changes in design, training and 
qualification, operations, and associated regulatory 
processes. Currently, many of these recommendations are 
being implemented. 

Commercial Transport Flight Deck Trends 

Most advances in flight deck capability since the advent of 
the first generation “glass cockpit” have been relatively 
evolutionary when assessed from an overall perspective. 
Some manufacturers would probably dispute this assertion 
as it applies to them. Airbus would mention differences 
between the A-310 and A-320, Boeing would cite 
differences between the B-757/767 and B-747-400, and 
McDonnell-Douglas would explain differences between the 
MD-80 and MD-11. Airbus and Boeing (which now 
includes the former McDonnell-Douglas) are justifiably 
proud of their products. However, both companies appear 
to spend some amount of their time defending their flight 
deck designs. In this competitive environment, certain 
major flight deck changes seem to be more difficult due to 
the apparent concern that such a change might constitute 
admission of a design weakness in a current product. 

In the past, a disconcerting industry trend has been the 
proliferation of flight deck system automation paradigms. 
One advantage of industry consolidation is that half of the 
large transport aircraft manufacturers have been eliminated 
(Fokker and McDonnell-Douglas). Another favorable trend 
is that within the remaining companies there have been 
recent efforts to consolidate on one flight deck design 
philosophy. Airbus has maximum commonality among 
its current production aircraft (A-3 19/3 20/321, A-330, and 
A-340). Boeing has made significant progress in achieving 
commonality among the B-777, B -7 37-600/700/800, and 
B-757/767 follow-ons. However, at the moment, it 
appears that Airbus’ automation philosophy is headed in 
one direction and Boeing’s in the other. Is this appropriate 
for the industry? This question is being asked in public 
forums. (11) Also, earlier models from both companies , as 
well as Fokker and McDonnell-Douglas, do not have a 
flight deck automation approach consistent with the above 
mentioned aircraft, but they are still flying in airline 


service and are expected to continue doing so for many 
years. 

Another flight deck trend worth considering is the 
introduction of government-mandated flight deck “safety” 
systems, such as Windshear, Ground Proximity Warning 
System (GPWS), Traffic Collision Alerting System 
(TCAS), and others. The establishment of a regulation 
requiring these systems has typically been a governmental 
response to an accident investigation (or a series of 
investigations). Creating a flight deck system to provide a 
“last line of defense” warning to the crew of imminent 
danger is a prime example of accident Prevention Strategy 
A (see A Model for Aviation Accidents ). In most cases, 
these systems are designed somewhat independently of a 
given aircraft’s flight deck design and installed as a 
“retrofit” (from a design perspective, this is true whether 
the hardware is installed on a production line or in a 
maintenance hangar). The “integration” task in these cases 
is to ensure that the new system performs its intended 
function, while preventing it from interfering with the 
existing flight deck systems (or vice versa). This is 
different from a design approach where the system 
functionality is integral to the flight deck design. For 
retrofits involving a single new system, the focus of the 
certification authorities is typically on verifying that the 
system performs its intended function and doesn’t interfere 
with the existing flight deck systems. For economic 
reasons, there is usually little interest in customizing the 
system implementation to each flight deck design. 
Therefore, over time, the flight deck designed by the 
manufacturer can be slowly “disintegrated” without the 
complete awareness of the manufacturer (who may not 
know about the retrofit), operator (who may not fully 
understand the flight deck design), or regulator (who is 
seeing each change separately over a long period of time). 

Built to Last: Airframe versus Avionics 

The lifespan of a modern commercial jet transport has 
unexpectedly affected the avionics implementation. With 
proper maintenance, the productive life of a modern 
commercial transport is approximately 30 years. In sharp 
contrast, the “technology lifespan” of computers and 
software in the last 15-20 years has been approximately 3 
years. The first “glass cockpit” commercial transport 
aircraft were designed in the late 1970’s, before the 
appearance of the personal computer; yet these aircraft are 
still being produced with an avionics architecture designed 
during that period. This architecture, now known as 
“federated,” uses individual line replaceable units 
communicating with each other via dedicated, hard- wired 
interfaces. Such an architecture was never designed to have 
its functionality expanded easily - the paradigm at the time 
was that increased functionality would generally occur by 
replacing existing units, and only occasionally by adding 
new units and interfaces to the existing system. 
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The latest generation of Airbus and Boeing aircraft have 
more advanced avionics, with varying levels of avionics 
integration that translate into varying sophistication and 
use of databuses to move data within the avionics 
architecture. However, even the most integrated avionics 
on these aircraft have limited extendibility within 
functional limits defined by their designers. Therefore, 
during the 45-year life (30 year aircraft life plus 15 years in 
production) of this design, it is inevitable that some 
function not envisioned by the designer will be developed 
that cannot be easily incorporated into the avionics 
architecture - this has a direct bearing on the ease with 
which a given flight deck modification can be made. 

A further point about the trend toward more integrated 
avionics is that current designs clearly indicate a focus on 
integration among the electronics and software rather than 
the functionality from the pilot perspective. A particular 
example is a modern transport aircraft where the autoflight 
“system” functions are hosted within the same avionics 
unit, yet the pilot must interface with what appears to be 
at least three different “systems,” placed in different flight 
deck locations. Potential reasons for this design choice 
include the desire to preserve “commonality” with flight 
decks in other aircraft manufactured by the company, and 
the avoidance of “certification risk” in proposing a new 
interface for the flight crew. 

A final observation about trends in modern commercial jet 
transport flight decks is that, for reasons described above, 
the aviation industry is not keeping up with the rapid 
advances that are occurring in the broader industry that 
produces real-time, reliable computational systems. In a 
total reversal of the situation that existed 15 years ago, 
today the average commercial jet transport in airline 
service has more computing power and better 
human/computer interfaces in the hands of the passengers 
than in the hands of the flight crew. Given the disparity in 
time between commercial transport aircraft product cycles 
(on the order of a decade) and information technology 
product cycles (on the order of a year), it is inevitable that 
this trend will continue unless the aviation industry does 
something different. 

In short, it seems apparent that the aviation industry must 
develop an approach to avionics architectures and flight 
deck design that enables integrated, extendible functionality 
from both the flight crew’s interaction level and at the 
engineering implementation level. A key feature of such 
an approach would be that “applications” (functions) with 
similar characteristics would have a common crew 
interaction paradigm. Another key feature of such an 
approach would be that the design allows new 
“applications” (functions) to be added after the product is 
fielded in service. This would be analogous to some of 
today’s personal computers. 


Redefining “Retrofit” 

An emerging trend could be the insertion of new flight 
deck systems and supporting avionics into an existing (or 
minimally modified) airframe design. The most extreme 
example of this known to the authors is the planned 
modification of several Federal Express DC-lO’s into 
“MD-10 ’s.” ( 12) This involves the conversion of the three- 
person DC- 10 flight deck into a two-person MD-10 flight 
deck based on the MD-1 1 flight deck design and systems. 
The MD-10 project could be viewed as a “retrofit” and may 
pave the way for future modifications of this scope. 

Such an approach may be a practical path to implementing 
future “new” flight deck designs that provide system- wide 
benefits. If such changes to an aircraft flight deck will 
yield significant improvements in both safety and 
operating economics, the likelihood of implementation 
will increase substantially. 

Tomorrow’s Airspace System 

The airspace system of the future is being “designed” 
today. Specifically, standards are being proposed by, and 
negotiated among, the various national aviation 
authorities, and the International Civil Aviation 
Organization (ICAO). The future airspace system is aimed 
at providing increased operational efficiencies for users of 
the airspace system, while preserving or enhancing 
existing safety and capacity levels. 

The CNS/ATM concept is a new paradigm for the 
architecture and operation of the airspace system, as 
illustrated in figure 10. Inherent in the successful 
implementation of CNS/ATM concepts is the idea that 
operational access and constraints are explicitly based on 
performance. This necessitates an explicit linkage between 
separation criteria and Required System Performance 
(RSP). RSP is used to define a “protected volume” around 
each aircraft based on its RSP - a higher level of RSP 
equates to the need for a smaller protected volume (which 
allows closer separation). This concept allows users to 
make explicit investment decisions vis-a-vis the aircraft- 
by-aircraft RSP they need to meet their operational 
requirements. 


Contract Probe Plan 

^ HH = 



Figure 10 — Future Airspace System Operational Concept 
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RSP is a combination of Required Communications 
Performance (RCP), Required Navigation Performance 
(RNP), and Required Monitoring Performance (RMP). 
RNP indicates how well a given airplane knows where it 
is and adheres to a defined flight path. (13) RMP indicates 
the accuracy of the information about positions, velocities, 
and accelerations of a set of aircraft in the airspace system. 
RCP indicates the message capacity, integrity, and time 
delay between initiation and its receipt at the intended 
location. 

The impact that different RSP levels will have on 
commercial transport flight decks is not easy to predict. 
The inherent “control structure” of today’s airspace system, 
described earlier, is such that ground-based personnel are 
mostly in the system outer loops and pilots are mostly in 
the system inner loops. As in any control system, 
information must flow between the inner and outer loops 
for the overall system to work. The humans in today’s 
system provide a large measure of this connectivity. It is 
not clear if the current “control structure” will provide the 
desired levels of RSP. It is also not clear how airspace 
system users will rely on airspace system providers to 
achieve a given level of RSP. One possible outcome is 
that more air traffic management functions (including 
separation) may be performed by the flight crew. Figure 1 1 
shows an example approach for how this might occur, 
with varying information available and activities occurring 
based on different system element dynamics. 



Figure 11 — An Approach for Flight Deck Involvement in Air 
Traffic Management 

Trends in the Global Environment 

There are several trends that can be observed in the broader 
marketplace that are likely to be major influences in future 
flight decks. 

Demographics of the Pilot Population 

Demographically, an entire generation of people who have 
grown up with the personal computer are about to reach 
the job market. The pilots of this generation are not 
“intimidated” by computers and have high expectations 
with regard to the ease of use of their computer. The 


authors postulate that this generation of pilots will not 
view the interfaces in today’s “modern” flight deck as 
acceptable; already today’s computer-literate pilots view 
the FMS Control Display Unit (CDU), with its 
alphabetically- ordered keypad and primitive interface, as 
hopelessly antiquated and awkward to use. 

Another demographic trend (at least, in the United States) 
is the percentage of current airline pilots who were trained 
to fly by the military. This trend has been slowly at work 
for years, but has accelerated in the post-Cold War era. The 
downsized military has needed to train few new pilots. 
Over time, this has resulted in a minuscule pool of 
military pilots for the airlines to hire. Yet the airlines’ 
requirements for pilots have grown with the size of the 
fleet (which has doubled worldwide in the last 20 years). 
The “Age 60” rule guarantees that the large number of US 
airline pilots who served in the military during the 
Vietnam War are on the verge of retirement. Replacing 
these pilots will lead to a larger number of “low-time” 
(relative to today) pilots operating sophisticated aircraft. 
Also, the airline pilot population will become less 
homogeneous as the number of former military pilots, 
united by their common (and relatively extensive) training 
experience, declines. 

“Revolutionary” Technologies 

There are several “revolutionary” technologies whose 
development is being driven by one or more broad 
commercial markets. 

Speech recognition has been pursued for decades, but 
only limited functionality is currently available on the 
market and many of these products are notorious for 
becoming nonfunctional in the presence of moderate 
background sounds and noise. However, the pace of 
development in this area is apparent by the progress seen 
in products for personal computers. The authors believe 
that inexpensive and robust speech recognition capabilities 
are only years away. This technology, implemented 
properly, could significantly alter human/computer 
interactions in the flight deck. 

Eyeglass-based displays technology is another 
“revolutionary” technology whose development is being 
driven by a commercial market much bigger and broader 
than aviation. In this case, the “market pull” is the 
entertainment and gaming industry. While today’s gaming 
devices are completely unsuitable for a flight deck 
application, one can imagine a device the size of ordinary 
eyeglasses, able to project images into the eye that appear 
superimposed on the outside scene in a manner analogous 
to the Heads Up Displays (HUD’s) found in all modern 
military aircraft. The capability to project, in a conformal 
manner superimposed over the pilot’ s out-the- window 
view, the position of terrain, traffic and weather, would 
have significant implications for current flight deck 
systems, interfaces and configuration. 
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The authors believe that requirements to incorporate new 
technologies (such as those described above) developed 
“outside” the aviation community, combined with the 
environmental trends previously described, will contribute 
to the need for new flight deck designs. 

Human-Centered Flight Deck Design 

Because advanced aircraft are, and will continue to be, so 
heavily automated due to demands for efficiency and safety, 
and given the problems that have been noted in current 
flight decks, (9,10,14,15) it seems apparent that a new approach 
should be considered. This approach is becoming known as 
human-centered flight deck design. Human-centered flight 
deck design is primarily a ‘systems’ approach to design of 
the ‘interface’ between the pilot and aircraft (i.e., the flight 
deck). The approach has also been referred to as a ‘top- 
down,’ requirements-driven methodology, where the 
requirements are formulated hierarchically from mission 
objectives and more extensively include human 
performance considerations. This approach can be used to 
design new flight decks or to retrofit existing flight deck 
designs. 

Human-centered flight deck design allows multiple design 
concepts, including “radical” ones. (16) Human-centered 
flight deck design is a Prevention Strategy B, though a 
resulting flight deck implementation could be viewed as a 
Prevention Strategy C (see A Model for Aviation 
Accidents ). The elements of human-centered flight deck 
design are described below. 

Human-Centered Design Principles 

The basic tenet of human-centered design principles is that, 
“The Human Operator Must Be in Command.” (17) In an 
aircraft, this means the pilot shall always be in command, 
even when using automation. Thus, automation, including 
air traffic management automation, must never remove the 
pilots from the command role, either implicitly or 
explicitly. Command entails both authority and awareness. 
Reference (17) stresses the need for appropriate pilot 
involvement in, information about, and comprehension of 
the tasks being performed. While it is tempting to view 
this as strictly an interface problem, closer examination 
reveals that it is a systems problem. Information and 
format can assist in making complexity understandable, 
but it will not be as effective as reducing complexity. 
Likewise, displaying information about system status may 
assist the pilot in recognizing modes, but designing a 
system with only immediate and pilot-commanded mode 
changes should provide better awareness. Thus human- 
centered design starts at the overall function definition and 
allocation level rather than the interface level. The design 
should be based on a human-centered design philosophy 
and should reflect both the mission goals and the pilots’ 
roles. 


Design Philosophy 

A human-centered flight deck design philosophy has been 
developed at NASA Langley Research Center. (18) This 
philosophy is expressed as a set of guiding design 
principles, and is accompanied by information that will 
help focus attention on flight crew issues earlier and more 
systematically in the design process. 

The philosophy assumes that the flight crew will remain 
an integral component of the flight deck for the foreseeable 
future (see The Requirement for Human Operators ). The 
philosophy seeks to elevate design issues associated with 
the understanding of human performance and interaction 
with automation to the same level of importance as the 
historical focus on technological issues, such as hardware 
performance and reliability. Moreover, it considers the 
importance of optimizing the combined flight crew/flight 
deck system performance above any single component of 
the total system. It also seeks to elevate flight crew and 
flight deck issues to the same level of importance given 
other aircraft design disciplines, such as aerodynamics and 
structures. The philosophy includes the view that flight 
deck automation should always support various pilot roles 
in successfully completing the mission. These roles are: 
pilots as team members; pilots as commanders; pilots as 
individual operators; and, pilots as flight deck occupants. 

Function Allocation and Involvement 

Function allocation is an important element of flight deck 
design. It is at the heart of human-centered flight deck 
design. The following function allocation guideline is 
distilled from references (17) and (18): The pilot should, in 
general, be more involved in actions and decisions that 
have significant consequences on the overall mission, and 
be less involved in actions and decisions that are relatively 
deterministic, time constrained, tedious or repetitious, or 
require great precision. 

The purpose of involvement is to engage the pilot in the 
task. The purpose of engagement is to increase pilot 
situation awareness. When engagement is low due to 
factors such as boredom, complacency, or fatigue, the pilot 
enters a state described as a hazardous state of awareness. (19) 
One way these hazardous states of awareness may be 
identified is based on electroencephalogram (EEG) signals 
and other physiological indices. The model for predicting 
whether the flight crew will experience inappropriate or 
hazardous states of awareness involves three sets of factors: 
predisposing, inducing, and counteracting. (19) 

Examples of predisposing factors are how likely the 
individual is to become complacent, bored, or absorbed. 
Examples of inducing factors are sensory restriction (such 
as monotony) and stressor preoccupation from life 
situations. The model hypothesizes that counteracting 
factors negate or prevent the effects of the predisposing and 
inducing factors for hazardous states. Examples of 
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counteracting factors are attentional competence, 
communication flow, and task engagement. 

Reference (20) describes a system which measures mental 
task engagement. Because human/automation task 
allocation strongly influences task engagement, this 
engagement index may be used to evaluate various 
function allocation schemes for their influence on task 
engagement. 

Flight Deck Mission Categories 

Reference (21) proposes combining human-centered design 
principles with a systems-oriented approach to designing 
new flight decks which will meet overall mission 
requirements. It is hypothesized that this will reduce 
system integration problems. This approach requires that 
mission requirements are defined before any designing of 
the flight deck or other aircraft systems occur. 

In Reference (21), a mission goal is assumed for an aircraft 
to be that of moving “passengers and cargo from airport 
gate to airport gate safely and efficiently.” The overall 
function of the flight deck systems is assumed to be that 
of managing the mission of the aircraft. Both normal and 
abnormal situations are considered for accomplishing the 
mission. Four levels of mission management are defined: 
flight management, communications management, 
systems management, and task management. Although 
similar to the traditional pilot functions of aviate, 
navigate, and communicate, these categories are from the 
total flight deck perspective, rather than from just the 
pilot’s. The interactions among these functions create 
blended tasks for the flight crew. 

One of the design principles from reference (17) indicates 
that the behavior and purpose of the automation should be 
clear to the user. Thus, information relevant to the blended 
task should be presented to the flight crew, and in such a 
way that the underlying function(s) or relationships are 
transparent to the flight crew. An example of how to do 
this is presented below. 

Task-Oriented Display Design 

Reference (22) describes the development of a display 
design process using a function allocation that decomposes 
“the user’s task only to a level where relevant information 
can be identified” as opposed to where a data source could 
be identified. This “relevant information” may or may not 
be raw data, and can be synthesized from underlying data. 
The “relevant information” is presented in such a form as 
to be more appropriate for the task. 

This task-oriented design process was applied to develop an 
aircraft engine display. In a simulation evaluation, pilots 
had better performance than with a traditional display - the 
pilots also preferred the task-oriented display. This 
particular display was for the control of engine thrust and 
the monitoring of engine health. Rather than provide 


individual pieces of information which the pilot had to 
mentally combine (a task ill suited for humans and not 
directly related to the task), the display presented the 
information after it was combined. The synthesized 
information was presented in a form that was more 
appropriate for the pilot’ s task. The key to successfully 
using this function allocation process is understanding the 
real task the user or flight crew must perform. (22) 
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Figure 12 — Erroneous Engine Pressure Ratio (EPR) 
Information, Traditional Engine Display 


Figure 12 shows a traditional engine display , and the task- 
oriented engine display is shown in figure 13. Both 
displays depict an identical scenario, which is similar to 
the 1982 Air Florida accident. In this scenario, the Engine 
Pressure Ratio (EPR) information is erroneously high 
during a takeoff task - the result is that the pilots may 
think they have set takeoff power, when in fact they have 
not. Figure 13 clearly shows the advantage of the task- 
oriented display in displaying a problem with takeoff 
power selection (the difference between the white and 
yellow bars on the left side). The task-oriented engine 
display also shows that both engine temperature (EGT) and 
fuel flow (FF) are much too low for the amount of power 
the engine is supposedly producing. (22) 



Figure 13 — Erroneous Engine Pressure Ratio (EPR) 
Information, Task-Oriented Engine Display 


Fault Management 

The use of automation and the complexity of aircraft 
systems in general has increased as technologies have 
matured. However, as complexity increases, so does the 
difficulty of recognizing, anticipating, and preventing 
system errors. The presence of these difficulties is called 
“brittleness. ” (17,23) To control the effect of brittleness, most 
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systems require a human to be incorporated in the system. 
This places the human in the unique role of troubleshooter 
and the last defense. 

This approach has been identified as having human/system 
performance vulnerabilities, especially in the flight deck. 
Reference (24) points out that the response to human 
performance issues in a complex automated system, such 
as a flight deck, has not kept up with the application of 
automation, so that these issues are only surfaced when 
accidents or incidents occur. One reason for having 
humans on the flight deck is to deal with problems, 
contingencies, or failures. Yet, the flight deck design, 
supporting training, and procedures, do not readily address 
this flight crew function. Flight crews are primarily 
provided training for normal operation and anticipated 
failures. If a failure is novel (unanticipated), the flight crew 
may not respond properly, (25) as supported by the number 
of inappropriate crew responses to failures; however, 
responding to novel failures is an accepted part of the 
flight crew’s job. 

Reference (26) presents a framework for real-time fault 
management that integrates three elements: 

• operational levels - which are the aircraft mission, the 
physical aircraft in an aerodynamic environment, and 
the aircraft systems; 

• cognitive levels of control - which are defined as 
skill-based, rule-based, and knowledge-based 
behaviors; and, 

• operational fault management tasks - which are 
detection, diagnosis, prognosis, and compensation. 

The combination of all these factors describe crucial fault 
management issues which should be reviewed in any flight 
deck design. 

Likely Future Flight Deck Elements 

We do not know for certain what the flight decks of the 
future will look like, nor how they will function. 

However, the authors believe that future flight decks will 
contain at least some of the following elements: 

• Sidestick control inceptors, interconnected and with 
tailorable force/feel, preferably “backdriven” during 
autopilot engagement 

• “Mode-less” flight path management 

• Display area filled with large, high resolution displays 
having multiple signal sources (computer-generated 
and video) 

• Graphical interfaces for appropriate flight deck 
systems 

• High-bandwidth, two-way datalink communication 
capability embedded in appropriate flight deck systems 

• Voice interfaces for appropriate flight deck systems 

• Modular avionics architectures designed to be upgraded 
every 5-10 years, with both new hardware (processor, 
memory, storage) and new software (“applications” 
and “operating system”) 


In the longer term, it is possible that future flight decks 
will also include glasses-mounted displays that enable 
“virtual environment” presentations of traffic, weather, 
terrain, etc. 

Market Prospects for Flight Deck Innovation 

Although this paper has concentrated on commercial jet 
transport flight decks, there are opportunities for flight 
deck innovation that span the entire aviation industry. 

The single engine general aviation market is a significant 
opportunity for flight deck innovation. Flight deck designs 
that are significantly easier to operate than historical 
designs could reduce barriers to entry (both initial training 
and ownership), thereby significantly expanding the market 
potential of this segment. One vision for this segment is 
an aircraft with operating capability and costs that are 
commensurate with luxury automobiles. 

The multi-engine corporate airplane market is another 
significant opportunity for flight deck innovation. The 
authors contend that the aircraft in this market segment 
already include some of the most sophisticated flight deck 
capabilities in the world. Given that most corporate 
operators lack a large fleet or pilot workforce, there are far 
fewer training barriers to adoption of new technology and 
new systems in these aircraft. This segment also has a 
high historic interest in obtaining the latest avionics 
capabilities and improving safety. The substantial 
resources available in this segment, coupled with the 
above factors, appears to make this segment the most open 
to ‘revolutionary’ improvements in flight deck design. 

This is evidenced by the development of advanced flight 
deck avionics suites, such as Honeywell’s Primus Epic™. 

The commuter airline segment wants to lower its accident 
rate to become “as safe” as the major airlines. This need is 
made more complex by the relative inexperience of the 
average commuter airline pilot. However, many of the 
aircraft used in commuter airline service use the same 
avionics suites as the multi-engine corporate segment; 
therefore, leverage is possible. 

Interestingly, today’s subsonic commercial jet transport 
segment has the least apparent requirement for flight deck 
innovation. Vulnerabilities exist, but commercial jet 
transports are generally the safest form of aviation 
transportation available. However, as the airspace systems 
transitions to future operational environments, 
opportunities for flight deck innovation will present 
themselves. Also, if another aviation market segment 
takes the “certification risk” and develops a new and 
successful flight deck design approach, it is possible that 
commercial jet transports will adopt it. 

Looking toward the future, the potential emergence of 
economic supersonic commercial jet transports, if realized, 
would present flight deck innovation opportunities. NASA 
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studies to date have shown that unique vehicle/operational 
requirements will require flight deck solutions that differ 
significantly from today’s subsonic transport aircraft. 

Concluding Remarks 

The demand for commercial aviation accident rate reduction 
will be relentless, since accident rate reduction will be 
required to realize the projected growth in global aviation. 
Since “pilot error” continues to be cited as a major factor 
in the majority of accidents, it will receive attention 
leading to the realization that the needed safety 
improvements cannot be accomplished with procedural and 
training changes alone. Computer and communication 
technologies will be created by the demands of the broader 
commercial market - these technologies will have 
significant potential in aviation applications. Human- 
centered flight deck design methodologies will be applied 
to produce a lasting (and perhaps singular) human-centered 
systems framework that will be used as a basis for 
modifying flight deck implementations as technologies 
evolve or become available for use. It is too early to tell, 
but we may be near the threshold of a ‘revolution’ that 
leads to significant changes in flight deck systems and how 
pilots interact with them. 
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